EUVD-2026-28831Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Campaign submission is network-delivered with no complexity; PR:L reflects required member account; UI:R and S:C capture admin-viewer interaction triggering cross-context script execution.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cross-site scripting (XSS) vulnerability exists in the campaign management feature, where the email body content created by authenticated project members is stored and later rendered in the admin dashboard using React's dangerouslySetInnerHTML without any HTML sanitization. This allows a lower-privileged member to embed malicious scripts in a campaign's email body that execute in the context of any admin or other member who views the campaign, potentially enabling session hijacking or unauthorized actions on their behalf. This issue has been patched in version 0.9.0.
AnalysisAI
Stored XSS in Plunk's campaign management feature allows authenticated project members with lower privileges to inject malicious scripts into email body content that subsequently executes in the browser session of any admin or peer member who views the campaign in the admin dashboard. The root cause is React's dangerouslySetInnerHTML API rendering unsanitized user-supplied HTML, bypassing React's built-in XSS protections. No active exploitation is confirmed (not in CISA KEV, EPSS at 0.03%), and a vendor-released patch exists in v0.9.0 integrating DOMPurify; however, the insider privilege-escalation threat model - member to admin - makes patching a meaningful priority for multi-user deployments.
Technical ContextAI
Plunk is an open-source self-hosted email marketing platform built on AWS SES (CPE: cpe:2.3:a:useplunk:plunk). The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). React's dangerouslySetInnerHTML is a deliberate escape hatch that injects raw HTML strings directly into the DOM, explicitly bypassing React's automatic output encoding. When campaign email body content - submitted by lower-privileged members - is stored in the database and later retrieved for rendering in the admin dashboard via this API without sanitization, any embedded script tags or event-handler attributes execute in the viewer's browser context. The v0.9.0 fix integrates DOMPurify (confirmed in release commit bf12392), a standard DOM sanitization library that strips malicious markup prior to rendering.
RemediationAI
Upgrade to Plunk v0.9.0, which integrates DOMPurify to sanitize HTML content before it is passed to dangerouslySetInnerHTML, directly eliminating the root cause; the release is available at https://github.com/useplunk/plunk/releases/tag/v0.9.0 and the fix is confirmed by commit bf12392. If immediate upgrade is not feasible, restrict campaign creation permissions to fully trusted admin-level accounts only, removing 'member' role access to the campaign editor - note this degrades collaborative workflow and may not be granular depending on Plunk's RBAC implementation. As an additional precaution prior to patching, audit existing campaign bodies for <script> tags, javascript: URIs, or inline event handlers (onload, onerror, etc.) that may have already been injected.
SSRF in Plunk email platform before 0.7.0.
Amazon SNS webhook spoofing in Plunk before 0.9.0 lets any unauthenticated remote attacker forge notifications to the /w
CRLF injection in Plunk email platform's SESService.ts allows authenticated API users to inject arbitrary MIME headers b
Plunk is an open-source email platform built on top of AWS SES. versions up to 0.7.1 is affected by cross-site scripting
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today